@learncard/sss-key-manager 0.1.21 → 0.1.23

package/dist/sss-key-manager.esm.js

@@ -60,6 +60,8 @@ var require_types_cjs_development = __commonJS({
       AgeRatingValidator: /* @__PURE__ */ __name(() => AgeRatingValidator, "AgeRatingValidator"),
       AlignmentTargetTypeValidator: /* @__PURE__ */ __name(() => AlignmentTargetTypeValidator, "AlignmentTargetTypeValidator"),
       AlignmentValidator: /* @__PURE__ */ __name(() => AlignmentValidator, "AlignmentValidator"),
+      AllocateCredentialRefreshInputValidator: /* @__PURE__ */ __name(() => AllocateCredentialRefreshInputValidator, "AllocateCredentialRefreshInputValidator"),
+      AllocateCredentialRefreshResultValidator: /* @__PURE__ */ __name(() => AllocateCredentialRefreshResultValidator, "AllocateCredentialRefreshResultValidator"),
       AllocateCredentialStatusInputValidator: /* @__PURE__ */ __name(() => AllocateCredentialStatusInputValidator, "AllocateCredentialStatusInputValidator"),
       AllocatedBitstringStatusListEntryValidator: /* @__PURE__ */ __name(() => AllocatedBitstringStatusListEntryValidator, "AllocatedBitstringStatusListEntryValidator"),
       AllowConnectionRequestsEnum: /* @__PURE__ */ __name(() => AllowConnectionRequestsEnum, "AllowConnectionRequestsEnum"),
@@ -109,6 +111,7 @@ var require_types_cjs_development = __commonJS({
       ConsentFlowContractValidator: /* @__PURE__ */ __name(() => ConsentFlowContractValidator, "ConsentFlowContractValidator"),
       ConsentFlowDataForDidQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowDataForDidQueryValidator, "ConsentFlowDataForDidQueryValidator"),
       ConsentFlowDataQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowDataQueryValidator, "ConsentFlowDataQueryValidator"),
+      ConsentFlowGuardianApprovalValidator: /* @__PURE__ */ __name(() => ConsentFlowGuardianApprovalValidator, "ConsentFlowGuardianApprovalValidator"),
       ConsentFlowTermValidator: /* @__PURE__ */ __name(() => ConsentFlowTermValidator, "ConsentFlowTermValidator"),
       ConsentFlowTermsQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowTermsQueryValidator, "ConsentFlowTermsQueryValidator"),
       ConsentFlowTermsStatusValidator: /* @__PURE__ */ __name(() => ConsentFlowTermsStatusValidator, "ConsentFlowTermsStatusValidator"),
@@ -141,6 +144,16 @@ var require_types_cjs_development = __commonJS({
       CredentialInfoValidator: /* @__PURE__ */ __name(() => CredentialInfoValidator, "CredentialInfoValidator"),
       CredentialNameRefValidator: /* @__PURE__ */ __name(() => CredentialNameRefValidator, "CredentialNameRefValidator"),
       CredentialRecordValidator: /* @__PURE__ */ __name(() => CredentialRecordValidator, "CredentialRecordValidator"),
+      CredentialRefreshChallengeValidator: /* @__PURE__ */ __name(() => CredentialRefreshChallengeValidator, "CredentialRefreshChallengeValidator"),
+      CredentialRefreshFailedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshFailedResultValidator, "CredentialRefreshFailedResultValidator"),
+      CredentialRefreshFailureCodeValidator: /* @__PURE__ */ __name(() => CredentialRefreshFailureCodeValidator, "CredentialRefreshFailureCodeValidator"),
+      CredentialRefreshResponseEnvelopeValidator: /* @__PURE__ */ __name(() => CredentialRefreshResponseEnvelopeValidator, "CredentialRefreshResponseEnvelopeValidator"),
+      CredentialRefreshResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshResultValidator, "CredentialRefreshResultValidator"),
+      CredentialRefreshSigningModeValidator: /* @__PURE__ */ __name(() => CredentialRefreshSigningModeValidator, "CredentialRefreshSigningModeValidator"),
+      CredentialRefreshUnchangedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUnchangedResultValidator, "CredentialRefreshUnchangedResultValidator"),
+      CredentialRefreshUnsupportedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUnsupportedResultValidator, "CredentialRefreshUnsupportedResultValidator"),
+      CredentialRefreshUpdatedResultValidator: /* @__PURE__ */ __name(() => CredentialRefreshUpdatedResultValidator, "CredentialRefreshUpdatedResultValidator"),
+      CredentialRefreshVersionMetadataValidator: /* @__PURE__ */ __name(() => CredentialRefreshVersionMetadataValidator, "CredentialRefreshVersionMetadataValidator"),
       CredentialSchemaValidator: /* @__PURE__ */ __name(() => CredentialSchemaValidator, "CredentialSchemaValidator"),
       CredentialStatusValidator: /* @__PURE__ */ __name(() => CredentialStatusValidator, "CredentialStatusValidator"),
       CredentialSubjectValidator: /* @__PURE__ */ __name(() => CredentialSubjectValidator, "CredentialSubjectValidator"),
@@ -161,6 +174,8 @@ var require_types_cjs_development = __commonJS({
       GeoCoordinatesValidator: /* @__PURE__ */ __name(() => GeoCoordinatesValidator, "GeoCoordinatesValidator"),
       GetCounterEventValidator: /* @__PURE__ */ __name(() => GetCounterEventValidator, "GetCounterEventValidator"),
       GetCountersEventValidator: /* @__PURE__ */ __name(() => GetCountersEventValidator, "GetCountersEventValidator"),
+      GetCredentialRefreshHistoryInputValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshHistoryInputValidator, "GetCredentialRefreshHistoryInputValidator"),
+      GetCredentialRefreshHistoryResultValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshHistoryResultValidator, "GetCredentialRefreshHistoryResultValidator"),
       GetFullSkillTreeInputValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeInputValidator, "GetFullSkillTreeInputValidator"),
       GetFullSkillTreeResultValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeResultValidator, "GetFullSkillTreeResultValidator"),
       GetSkillPathInputValidator: /* @__PURE__ */ __name(() => GetSkillPathInputValidator, "GetSkillPathInputValidator"),
@@ -185,6 +200,7 @@ var require_types_cjs_development = __commonJS({
       JWEValidator: /* @__PURE__ */ __name(() => JWEValidator, "JWEValidator"),
       JWKValidator: /* @__PURE__ */ __name(() => JWKValidator, "JWKValidator"),
       JWKWithPrivateKeyValidator: /* @__PURE__ */ __name(() => JWKWithPrivateKeyValidator, "JWKWithPrivateKeyValidator"),
+      JweCredentialRefreshEnvelopeValidator: /* @__PURE__ */ __name(() => JweCredentialRefreshEnvelopeValidator, "JweCredentialRefreshEnvelopeValidator"),
       KnownAchievementTypeValidator: /* @__PURE__ */ __name(() => KnownAchievementTypeValidator, "KnownAchievementTypeValidator"),
       LCNAuthedProfileValidator: /* @__PURE__ */ __name(() => LCNAuthedProfileValidator, "LCNAuthedProfileValidator"),
       LCNBoostClaimLinkOptionsValidator: /* @__PURE__ */ __name(() => LCNBoostClaimLinkOptionsValidator, "LCNBoostClaimLinkOptionsValidator"),
@@ -222,7 +238,9 @@ var require_types_cjs_development = __commonJS({
       LCNSigningAuthorityValidator: /* @__PURE__ */ __name(() => LCNSigningAuthorityValidator, "LCNSigningAuthorityValidator"),
       LCNVisibleProfileValidator: /* @__PURE__ */ __name(() => LCNVisibleProfileValidator, "LCNVisibleProfileValidator"),
       LaunchTypeValidator: /* @__PURE__ */ __name(() => LaunchTypeValidator, "LaunchTypeValidator"),
+      LearnCardRefreshAuthorizationValidator: /* @__PURE__ */ __name(() => LearnCardRefreshAuthorizationValidator, "LearnCardRefreshAuthorizationValidator"),
       LinkProviderFrameworkInputValidator: /* @__PURE__ */ __name(() => LinkProviderFrameworkInputValidator, "LinkProviderFrameworkInputValidator"),
+      ManagedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshServiceValidator, "ManagedCredentialRefreshServiceValidator"),
       PaginatedAppStoreListingsValidator: /* @__PURE__ */ __name(() => PaginatedAppStoreListingsValidator, "PaginatedAppStoreListingsValidator"),
       PaginatedBoostRecipientsValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsValidator, "PaginatedBoostRecipientsValidator"),
       PaginatedBoostRecipientsWithChildrenValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsWithChildrenValidator, "PaginatedBoostRecipientsWithChildrenValidator"),
@@ -252,6 +270,12 @@ var require_types_cjs_development = __commonJS({
       ProfileVisibilityEnum: /* @__PURE__ */ __name(() => ProfileVisibilityEnum, "ProfileVisibilityEnum"),
       PromotionLevelValidator: /* @__PURE__ */ __name(() => PromotionLevelValidator, "PromotionLevelValidator"),
       ProofValidator: /* @__PURE__ */ __name(() => ProofValidator, "ProofValidator"),
+      PublicCredentialRefreshEnvelopeValidator: /* @__PURE__ */ __name(() => PublicCredentialRefreshEnvelopeValidator, "PublicCredentialRefreshEnvelopeValidator"),
+      PublishCredentialRefreshInputValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshInputValidator, "PublishCredentialRefreshInputValidator"),
+      PublishCredentialRefreshNotificationValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshNotificationValidator, "PublishCredentialRefreshNotificationValidator"),
+      PublishCredentialRefreshResultValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshResultValidator, "PublishCredentialRefreshResultValidator"),
+      PublishIssuerSignedRefreshValidator: /* @__PURE__ */ __name(() => PublishIssuerSignedRefreshValidator, "PublishIssuerSignedRefreshValidator"),
+      PublishSigningAuthorityRefreshValidator: /* @__PURE__ */ __name(() => PublishSigningAuthorityRefreshValidator, "PublishSigningAuthorityRefreshValidator"),
       RefreshServiceValidator: /* @__PURE__ */ __name(() => RefreshServiceValidator, "RefreshServiceValidator"),
       RegExpValidator: /* @__PURE__ */ __name(() => RegExpValidator, "RegExpValidator"),
       RelatedValidator: /* @__PURE__ */ __name(() => RelatedValidator, "RelatedValidator"),
@@ -292,11 +316,13 @@ var require_types_cjs_development = __commonJS({
       SkillTreeNodeInputValidator: /* @__PURE__ */ __name(() => SkillTreeNodeInputValidator, "SkillTreeNodeInputValidator"),
       SkillTreeNodeValidator: /* @__PURE__ */ __name(() => SkillTreeNodeValidator, "SkillTreeNodeValidator"),
       SkillValidator: /* @__PURE__ */ __name(() => SkillValidator, "SkillValidator"),
+      StandardCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => StandardCredentialRefreshServiceValidator, "StandardCredentialRefreshServiceValidator"),
       StatusCheckEntryValidator: /* @__PURE__ */ __name(() => StatusCheckEntryValidator, "StatusCheckEntryValidator"),
       StoredCredentialEnvelopeValidator: /* @__PURE__ */ __name(() => StoredCredentialEnvelopeValidator, "StoredCredentialEnvelopeValidator"),
       StringQuery: /* @__PURE__ */ __name(() => StringQuery, "StringQuery"),
       SummaryCredentialDataValidator: /* @__PURE__ */ __name(() => SummaryCredentialDataValidator, "SummaryCredentialDataValidator"),
       SummaryCredentialKeywordValidator: /* @__PURE__ */ __name(() => SummaryCredentialKeywordValidator, "SummaryCredentialKeywordValidator"),
+      SupportedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => SupportedCredentialRefreshServiceValidator, "SupportedCredentialRefreshServiceValidator"),
       SyncFrameworkInputValidator: /* @__PURE__ */ __name(() => SyncFrameworkInputValidator, "SyncFrameworkInputValidator"),
       TagValidator: /* @__PURE__ */ __name(() => TagValidator, "TagValidator"),
       TemplateRenderMethodValidator: /* @__PURE__ */ __name(() => TemplateRenderMethodValidator, "TemplateRenderMethodValidator"),
@@ -15732,14 +15758,22 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }).catchall(external_exports.any());
     var ProofValidator = external_exports.object({
       type: external_exports.string(),
-      created: external_exports.string(),
+      created: external_exports.string().optional(),
       challenge: external_exports.string().optional(),
       domain: external_exports.string().optional(),
       nonce: external_exports.string().optional(),
       proofPurpose: external_exports.string(),
       verificationMethod: external_exports.string(),
       jws: external_exports.string().optional()
-    }).catchall(external_exports.any());
+    }).catchall(external_exports.any()).superRefine((proof, ctx) => {
+      if (proof.created === void 0 && (proof.type !== "DataIntegrityProof" || proof.cryptosuite !== "ecdsa-rdfc-2019")) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["created"],
+          message: "created is required for this proof suite"
+        });
+      }
+    });
     var VCValidator = UnsignedVCValidator.extend({
       proof: ProofValidator.or(ProofValidator.array())
     });
@@ -16500,7 +16534,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       webhookUrl: external_exports.string().url().optional().describe("Webhook URL to receive claim notifications"),
       suppressDelivery: external_exports.boolean().optional().describe("If true, returns claimUrl without sending email/SMS"),
       branding: SendBrandingOptionsValidator.optional().describe("Branding for email/SMS delivery"),
-      guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim")
+      guardianEmail: external_exports.string().email().optional().describe("Guardian email that must approve before student can claim"),
+      expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+        "How many days the credential stays claimable in the Universal Inbox (default 30). Does not change the credential validity period."
+      )
     });
     var SendBoostInputValidator = external_exports.object({
       type: external_exports.literal("boost"),
@@ -16621,15 +16658,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     var PaginatedConsentFlowDataValidator = PaginationResponseValidator.extend({
       records: ConsentFlowContractDataValidator.array()
     });
-    var ConsentFlowContractDataForDidValidator = external_exports.object({
-      credentials: external_exports.object({ category: external_exports.string(), uri: external_exports.string() }).array(),
-      personal: external_exports.record(external_exports.string(), external_exports.string()).default({}),
-      date: external_exports.string(),
-      contractUri: external_exports.string()
-    });
-    var PaginatedConsentFlowDataForDidValidator = PaginationResponseValidator.extend({
-      records: ConsentFlowContractDataForDidValidator.array()
-    });
     var ConsentFlowTermValidator = external_exports.object({
       sharing: external_exports.boolean().optional(),
       shared: external_exports.string().array().optional(),
@@ -16663,6 +16691,34 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         status: ConsentFlowTermsStatusValidator
       }).array()
     });
+    var ConsentFlowGuardianApprovalValidator = external_exports.object({
+      guardianProfileId: external_exports.string(),
+      guardianDid: external_exports.string(),
+      approvedAt: external_exports.string().datetime(),
+      contractUpdatedAt: external_exports.string()
+    });
+    var ConsentFlowContractDataForDidValidator = external_exports.object({
+      credentials: external_exports.object({ category: external_exports.string(), uri: external_exports.string() }).array(),
+      personal: external_exports.record(external_exports.string(), external_exports.string()).default({}),
+      date: external_exports.string(),
+      createdAt: external_exports.string().optional(),
+      contractUpdatedAt: external_exports.string(),
+      contractExpiresAt: external_exports.string().optional(),
+      reasonForAccessing: external_exports.string().optional(),
+      guardian: external_exports.object({
+        required: external_exports.boolean(),
+        approved: external_exports.boolean(),
+        approval: ConsentFlowGuardianApprovalValidator.optional()
+      }),
+      contractUri: external_exports.string(),
+      termsUri: external_exports.string(),
+      status: ConsentFlowTermsStatusValidator,
+      expiresAt: external_exports.string().optional(),
+      terms: ConsentFlowTermsValidator
+    });
+    var PaginatedConsentFlowDataForDidValidator = PaginationResponseValidator.extend({
+      records: ConsentFlowContractDataForDidValidator.array()
+    });
     var ConsentFlowContractQueryValidator = external_exports.object({
       read: external_exports.object({
         anonymize: external_exports.boolean().optional(),
@@ -16723,6 +16779,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       expiresAt: external_exports.string().optional(),
       oneTime: external_exports.boolean().optional(),
       terms: ConsentFlowTermsValidator.optional(),
+      guardianApproval: ConsentFlowGuardianApprovalValidator.optional(),
       id: external_exports.string(),
       action: ConsentFlowTransactionActionValidator,
       date: external_exports.string(),
@@ -16795,7 +16852,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       "APP_NOTIFICATION",
       "CREDENTIAL_REVOKED",
       "CREDENTIAL_SUSPENDED",
-      "CREDENTIAL_UNSUSPENDED"
+      "CREDENTIAL_UNSUSPENDED",
+      "CREDENTIAL_REFRESHED"
     ]);
     var LCNNotificationMessageValidator = external_exports.object({
       title: external_exports.string().optional(),
@@ -16927,12 +16985,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     });
     var InboxCredentialValidator = external_exports.object({
       id: external_exports.string(),
-      credential: external_exports.string(),
+      credential: external_exports.string().optional(),
       isSigned: external_exports.boolean(),
       currentStatus: LCNInboxStatusEnumValidator,
       isAccepted: external_exports.boolean().optional(),
       expiresAt: external_exports.string(),
       createdAt: external_exports.string(),
+      finalizedAt: external_exports.string().optional(),
+      expiredAt: external_exports.string().optional(),
+      credentialName: external_exports.string().optional(),
+      achievementType: external_exports.string().optional(),
       issuerDid: external_exports.string(),
       webhookUrl: external_exports.string().optional(),
       boostUri: external_exports.string().optional(),
@@ -16986,7 +17048,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
           "The signing authority to use for the credential. If not provided, the users default signing authority will be used if the credential is not signed."
         ),
         webhookUrl: external_exports.string().url().optional().describe("The webhook URL to receive credential issuance events."),
-        expiresInDays: external_exports.number().min(1).max(365).optional().describe("The number of days the credential will be valid for."),
+        expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+          "How many days the encrypted inbox payload remains claimable. This does not change the credential validity period."
+        ),
         templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe(
           "Template data to render into the boost credential template using Mustache syntax. Only used when boostUri is provided."
         ),
@@ -17049,6 +17113,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       credential: VCValidator.or(VPValidator).or(UnsignedVCValidator).or(CredentialNameRefValidator).describe("The credential to issue, or a { name } reference to resolve a boost template."),
       configuration: external_exports.object({
         publishableKey: external_exports.string(),
+        expiresInDays: external_exports.number().int().min(1).max(720).optional().describe(
+          "Inbox claim window in days. Defaults to 720; use a shorter window for sensitive records."
+        ),
         signingAuthorityName: external_exports.string().optional(),
         listingId: external_exports.string().optional(),
         listingSlug: external_exports.string().optional()
@@ -17686,6 +17753,191 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       const result = inAppMessagesFlagValidator.safeParse(raw);
       return result.success ? result.data : EMPTY_IN_APP_MESSAGES_FLAG;
     }, "parseInAppMessagesFlag");
+    var LearnCardRefreshAuthorizationValidator = external_exports.object({ type: external_exports.literal("LearnCardDIDAuth") }).catchall(external_exports.any());
+    var ManagedCredentialRefreshServiceValidator = external_exports.object({
+      id: external_exports.string().min(1),
+      type: external_exports.literal("LearnCardCredentialRefresh2026"),
+      authorization: LearnCardRefreshAuthorizationValidator.optional()
+    }).catchall(external_exports.any());
+    var StandardCredentialRefreshServiceValidator = external_exports.object({
+      id: external_exports.string().min(1),
+      type: external_exports.literal("1EdTechCredentialRefresh")
+    }).catchall(external_exports.any());
+    var SupportedCredentialRefreshServiceValidator = external_exports.union([
+      ManagedCredentialRefreshServiceValidator,
+      StandardCredentialRefreshServiceValidator
+    ]);
+    var AllocateCredentialRefreshInputValidator = external_exports.object({
+      holder: external_exports.object({
+        profileId: external_exports.string().optional(),
+        did: external_exports.string().min(1)
+      }),
+      credentialId: external_exports.string().min(1)
+    });
+    var AllocateCredentialRefreshResultValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      refreshService: ManagedCredentialRefreshServiceValidator.extend({
+        authorization: LearnCardRefreshAuthorizationValidator
+      })
+    });
+    var CredentialRefreshSigningModeValidator = external_exports.enum(["issuer-signed", "signing-authority"]);
+    var PublishCredentialRefreshBaseFields = {
+      refreshId: external_exports.string().min(1),
+      notifyHolder: external_exports.boolean().optional(),
+      updateSummary: external_exports.string().optional(),
+      idempotencyKey: external_exports.string().optional()
+    };
+    var PublishIssuerSignedRefreshValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: external_exports.literal("issuer-signed"),
+      signedCredential: VCValidator
+    });
+    var PublishSigningAuthorityRefreshValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: external_exports.literal("signing-authority"),
+      credential: UnsignedVCValidator,
+      signingAuthority: external_exports.object({
+        type: external_exports.string().min(1)
+      }).catchall(external_exports.any())
+    });
+    var PublishCredentialRefreshInputValidator = external_exports.object({
+      ...PublishCredentialRefreshBaseFields,
+      mode: CredentialRefreshSigningModeValidator,
+      signedCredential: VCValidator.optional(),
+      credential: UnsignedVCValidator.optional(),
+      signingAuthority: external_exports.object({
+        type: external_exports.string().min(1)
+      }).catchall(external_exports.any()).optional()
+    }).superRefine((input, ctx) => {
+      if (input.mode === "issuer-signed" && !input.signedCredential) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["signedCredential"],
+          message: "signedCredential is required for issuer-signed publication"
+        });
+      }
+      if (input.mode === "issuer-signed" && (input.credential !== void 0 || input.signingAuthority !== void 0)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["mode"],
+          message: "issuer-signed publication cannot include signing-authority fields"
+        });
+      }
+      if (input.mode === "signing-authority") {
+        if (input.signedCredential !== void 0) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signedCredential"],
+            message: "signing-authority publication cannot include signedCredential"
+          });
+        }
+        if (!input.credential) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["credential"],
+            message: "credential is required for signing-authority publication"
+          });
+        }
+        if (!input.signingAuthority) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["signingAuthority"],
+            message: "signingAuthority is required for signing-authority publication"
+          });
+        }
+      }
+    });
+    var PublishCredentialRefreshNotificationValidator = external_exports.enum([
+      "queued",
+      "suppressed",
+      "not-applicable",
+      /** Publication succeeded, but the post-commit notification enqueue must be retried. */
+      "delivery-failed"
+    ]);
+    var PublishCredentialRefreshResultValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      version: external_exports.number().int().positive(),
+      publishedAt: external_exports.string().min(1),
+      notification: PublishCredentialRefreshNotificationValidator
+    });
+    var CredentialRefreshVersionMetadataValidator = external_exports.object({
+      version: external_exports.number().int().positive(),
+      publishedAt: external_exports.string().min(1),
+      effectiveAt: external_exports.string().optional(),
+      etag: external_exports.string().optional(),
+      signingMode: CredentialRefreshSigningModeValidator.optional(),
+      updateSummary: external_exports.string().optional()
+    });
+    var GetCredentialRefreshHistoryInputValidator = external_exports.object({
+      refreshId: external_exports.string().min(1),
+      cursor: external_exports.string().optional(),
+      limit: external_exports.number().int().positive().optional()
+    });
+    var GetCredentialRefreshHistoryResultValidator = external_exports.object({
+      records: CredentialRefreshVersionMetadataValidator.array(),
+      hasMore: external_exports.boolean(),
+      cursor: external_exports.string().optional()
+    });
+    var CredentialRefreshChallengeValidator = external_exports.object({
+      challenge: external_exports.string().min(1),
+      expiresAt: external_exports.string().min(1),
+      domain: external_exports.string().optional(),
+      scheme: external_exports.literal("LearnCardDIDAuth").optional()
+    });
+    var PublicCredentialRefreshEnvelopeValidator = external_exports.object({
+      format: external_exports.literal("vc"),
+      credential: VCValidator,
+      etag: external_exports.string().optional()
+    });
+    var JweCredentialRefreshEnvelopeValidator = external_exports.object({
+      format: external_exports.literal("jwe"),
+      jwe: JWEValidator,
+      etag: external_exports.string().optional(),
+      /** Present on LearnCard-managed endpoints; optional for interoperable JWE services. */
+      version: external_exports.number().int().positive().optional()
+    });
+    var CredentialRefreshResponseEnvelopeValidator = external_exports.discriminatedUnion("format", [
+      PublicCredentialRefreshEnvelopeValidator,
+      JweCredentialRefreshEnvelopeValidator
+    ]);
+    var CredentialRefreshFailureCodeValidator = external_exports.enum([
+      "UNAVAILABLE",
+      "TIMEOUT",
+      "UNSUPPORTED_SERVICE",
+      "UNAUTHORIZED",
+      "MALFORMED_RESPONSE",
+      "INVALID_PROOF",
+      "ISSUER_MISMATCH",
+      "ID_MISMATCH",
+      "ROLLBACK",
+      "REVOKED",
+      "UNSAFE_ENDPOINT"
+    ]);
+    var CredentialRefreshUpdatedResultValidator = external_exports.object({
+      status: external_exports.literal("updated"),
+      credential: VCValidator,
+      etag: external_exports.string().optional(),
+      managedVersion: external_exports.number().int().positive().optional()
+    });
+    var CredentialRefreshUnchangedResultValidator = external_exports.object({
+      status: external_exports.literal("unchanged"),
+      checkedAt: external_exports.string().min(1),
+      etag: external_exports.string().optional()
+    });
+    var CredentialRefreshUnsupportedResultValidator = external_exports.object({
+      status: external_exports.literal("unsupported")
+    });
+    var CredentialRefreshFailedResultValidator = external_exports.object({
+      status: external_exports.literal("failed"),
+      code: CredentialRefreshFailureCodeValidator,
+      retryable: external_exports.boolean()
+    });
+    var CredentialRefreshResultValidator = external_exports.discriminatedUnion("status", [
+      CredentialRefreshUpdatedResultValidator,
+      CredentialRefreshUnchangedResultValidator,
+      CredentialRefreshUnsupportedResultValidator,
+      CredentialRefreshFailedResultValidator
+    ]);
   }
 });